@anteros/core 0.0.33 → 0.0.35

package/bench-cache.ts

@@ -0,0 +1,70 @@
+// Scratch benchmark — `bun run bench-cache.ts` (depuis packages/core)
+// Vérifie que useCache fonctionne vraiment et mesure les ms (miss vs hit vs sans cache).
+import { useRest } from "./database/rest";
+import { formatConfig, cfg } from "./server/config";
+import { syncTenants } from "./database/tenant";
+import { syncCollections } from "./database/collection";
+
+const TENANT = "bench";
+const DB = "mongodb://localhost:27017/_DB_BENCH";
+const N = 10000; // docs seedés
+
+async function main() {
+    formatConfig({
+        server: { port: 4000, cache: { enabled: true, driver: "memory" } },
+        tenants: [{ id: TENANT, dir: "bench-tenant", database: { uri: DB } }],
+    });
+    await syncTenants();
+    await syncCollections();
+
+    (cfg as any).collections = [
+        { _tenant_: TENANT, slug: "items", fields: [{ name: "title", type: "string" }, { name: "count", type: "number" }], api: { access: { "*": true } } },
+    ];
+    const rest = new useRest({ internal: false, tenant_id: TENANT });
+    const col = rest.db.collection("items");
+
+    // Seed
+    console.log(`Seeding ${N} docs…`);
+    const batch = [];
+    for (let i = 0; i < N; i++) batch.push({ title: `item-${i % 100}`, count: i });
+    for (let i = 0; i < batch.length; i += 1000) await col.insertMany(batch.slice(i, i + 1000));
+    console.log("Seeded ✓");
+
+    const params = { $match: { count: { $gte: 1000, $lte: 9000 } }, $sort: { count: -1 }, $limit: 50 };
+
+    // 1. Sans cache — moyenne sur 100 requêtes
+    const t0 = performance.now();
+    const ITERS = 100;
+    for (let i = 0; i < ITERS; i++) await rest.find("items", params);
+    const noCacheAvg = (performance.now() - t0) / ITERS;
+
+    // 2. Avec cache — 1er appel (MISS → requête DB) puis hits
+    const tMiss = performance.now();
+    const r1 = await rest.find("items", params, { useCache: true });
+    const missMs = performance.now() - tMiss;
+    console.log(`MISS: ${r1.length} docs retournés (requête DB réelle)`);
+
+    const tHits = performance.now();
+    for (let i = 0; i < ITERS; i++) await rest.find("items", params, { useCache: true });
+    const hitAvg = (performance.now() - tHits) / ITERS;
+
+    // 3. Preuve que le hit sert BIEN depuis le cache (pas la DB) :
+    //    on mute DIRECTEMENT en DB (bypass framework) un doc présent dans le résultat.
+    await col.updateMany({ count: 9000 }, { $set: { title: "MUTATED-DIRECT-DB" } });
+    const cached = await rest.find("items", params, { useCache: true });
+    const dbFresh = await rest.find("items", params);
+    const stale = cached.some((d: any) => d.title === "MUTATED-DIRECT-DB");
+    const fresh = dbFresh.some((d: any) => d.title === "MUTATED-DIRECT-DB");
+
+    console.log("\n─── RÉSULTATS (driver memory, Mongo local) ───");
+    console.log(`Sans cache  : ${noCacheAvg.toFixed(3)} ms/requête  (${ITERS} requêtes)`);
+    console.log(`MISS (cache): ${missMs.toFixed(3)} ms  (1er appel → requête DB, résultat mis en cache)`);
+    console.log(`HIT (cache) : ${hitAvg.toFixed(3)} ms/requête  (${ITERS} requêtes)`);
+    console.log(`Gain        : ${(noCacheAvg / hitAvg).toFixed(0)}× plus rapide`);
+    console.log(`Preuve cache: cache sert ${stale ? "la VALEUR MUTÉE (bug! cache pas servi)" : "l'ANCIENNE valeur (cache servi ✓)"}, requête fraîche = ${fresh ? "nouvelle valeur (DB bien mutée ✓)" : "?"}`);
+
+    await col.drop();
+    process.exit(0);
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });

package/database/field.crypto.ts

@@ -0,0 +1,219 @@
+import { cfg } from "../server/config";
+import { AppError } from "../lib/error";
+import type { Collection } from "../types/collection";
+
+/**
+ * Field-level encryption — `encryption: true` encrypts the whole field value;
+ * `encryptionOptions: { path: 'zip' }` encrypts only a sub-path inside a
+ * `json` (or array of json) field, e.g. `address.zip`.
+ *
+ * Uses the server encryption config (utils.crypt.resolve() — mode-driven:
+ * symmetric AES-256-GCM or asymmetric RSA-OAEP envelope).
+ *
+ * - Writes (insert/update): encrypted values are encrypted BEFORE storage.
+ * - Reads: NO automatic decryption — ciphertext is returned as stored
+ *   (decrypt manually with utils.crypt.resolve().decrypt(value, true)).
+ *
+ * ⚠️ Encrypted values are opaque in Mongo — $match/$sort/$group on them operates
+ * on ciphertext (don't use them as query/order keys).
+ */
+
+async function getCipher() {
+    const { resolve } = await import("../utils/crypto");
+    return resolve();
+}
+
+type PathField = { name: string; paths: string[] };
+
+/** Fields marked `encryption: true` (whole value) */
+export function encryptedFields(col: Collection | null): string[] {
+    return (col?.fields ?? []).filter((f) => f.encryption).map((f) => f.name);
+}
+
+/** Fields with `encryptionOptions.path` (sub-path inside json / array of json) */
+export function encryptedPaths(col: Collection | null): PathField[] {
+    return (col?.fields ?? [])
+        .filter((f) => f.encryptionOptions?.path)
+        .map((f) => ({
+            name: f.name,
+            paths: (Array.isArray(f.encryptionOptions!.path) ? f.encryptionOptions!.path : [f.encryptionOptions!.path]) as string[],
+        }));
+}
+
+function requireConfig(col: Collection | null, targets: string[]) {
+    if (!cfg.server.encryption?.mode) {
+        throw new AppError(
+            `Encrypted field(s) [${targets.join(", ")}] require server.encryption to be configured (mode + keys)`,
+            { code: "ENCRYPTION_NOT_CONFIGURED", status: 500 }
+        );
+    }
+}
+
+/** Read a dot-path value ('a.b.c') */
+function getPath(obj: any, path: string): any {
+    return path.split(".").reduce((o, k) => (o == null ? undefined : o[k]), obj);
+}
+
+/** Write a dot-path value ('a.b.c') — only if the intermediate chain exists */
+function setPath(obj: Record<string, any>, path: string, value: any): void {
+    const parts = path.split(".");
+    let cur: any = obj;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const next = cur?.[parts[i]!];
+        if (!next || typeof next !== "object") return; // intermediate missing → nothing to encrypt
+        cur = next;
+    }
+    cur[parts[parts.length - 1]!] = value;
+}
+
+/** Encrypt the values at `paths` inside a json value — object or array of json objects */
+async function encryptAt(cipher: any, value: any, paths: string[]): Promise<any> {
+    if (Array.isArray(value)) {
+        return Promise.all(value.map((item) => encryptAt(cipher, item, paths)));
+    }
+    if (!value || typeof value !== "object") return value;
+    const out: Record<string, any> = { ...value };
+    for (const p of paths) {
+        const v = getPath(out, p);
+        if (v !== undefined && v !== null) {
+            setPath(out, p, await cipher.encrypt(JSON.stringify(v))); // JSON-wrap → decrypt(..., true) round-trips any value
+        }
+    }
+    return out;
+}
+
+/** Encrypt the encrypted values present in a write payload (new object, input untouched) */
+export async function encryptFields(col: Collection | null, data: Record<string, any> | null | undefined): Promise<any> {
+    const names = encryptedFields(col);
+    const pathFields = encryptedPaths(col);
+    if ((!names.length && !pathFields.length) || !data || typeof data !== "object") return data;
+    if (Array.isArray(data)) return Promise.all(data.map((d) => encryptFields(col, d)));
+
+    const targets = [...names, ...pathFields.map((p) => p.paths.map((path) => `${p.name}.${path}`)).flat()];
+    requireConfig(col, targets);
+
+    const out: Record<string, any> = { ...data };
+    const cipher = await getCipher();
+
+    // Whole-value fields (encryption: true)
+    for (const name of names) {
+        const v = out[name];
+        if (v !== undefined && v !== null) {
+            out[name] = await cipher.encrypt(JSON.stringify(v));
+        }
+    }
+    // Path fields (encryptionOptions.path) — encrypt only the sub-path(s)
+    for (const { name, paths } of pathFields) {
+        const v = out[name];
+        if (v !== undefined && v !== null) {
+            out[name] = await encryptAt(cipher, v, paths);
+        }
+    }
+    return out;
+}
+
+/**
+ * Encrypt $set / $setOnInsert values for encrypted fields; reject operators that
+ * cannot work on ciphertext ($inc, $push, $addToSet, …). $unset/$rename/$currentDate are safe.
+ */
+export async function encryptUpdate(col: Collection | null, update: Record<string, any> | null | undefined): Promise<any> {
+    const names = encryptedFields(col);
+    const pathFields = encryptedPaths(col);
+    if ((!names.length && !pathFields.length) || !update || typeof update !== "object") return update;
+    const nameSet = new Set(names);
+
+    // Resolve a $set key → whole-field | sub-path of a path-field | null (not encrypted)
+    const resolveKey = (k: string): { kind: "whole" | "path"; field: string; sub: string | null; paths?: string[] } | null => {
+        if (nameSet.has(k)) return { kind: "whole", field: k, sub: null };
+        const pf = pathFields.find((p) => k === p.name || k.startsWith(p.name + "."));
+        if (pf) {
+            const sub = k === pf.name ? null : k.slice(pf.name.length + 1);
+            // chemin exact, descendant ('zip.sub') ou à travers un index de array ('0.zip')
+            if (sub === null || pf.paths.some((p) => sub === p || sub.startsWith(p + ".") || sub.endsWith("." + p))) {
+                return { kind: "path", field: pf.name, sub, paths: pf.paths };
+            }
+        }
+        return null;
+    };
+
+    const out: Record<string, any> = { ...update };
+
+    for (const [op, values] of Object.entries(out)) {
+        if ((op === "$set" || op === "$setOnInsert") && values && typeof values === "object") {
+            const keys = Object.keys(values);
+            const hits = keys.map((k) => ({ k, hit: resolveKey(k) })).filter((x) => x.hit);
+            if (!hits.length) continue;
+            requireConfig(col, hits.map(({ hit }) => hit!.kind === "whole" ? hit!.field : hit!.sub ? `${hit!.field}.${hit!.sub}` : `${hit!.field}.${hit!.paths![0]}`));
+            const cipher = await getCipher();
+            const newValues: Record<string, any> = { ...values };
+            for (const { k, hit } of hits) {
+                const v = newValues[k];
+                if (v === undefined || v === null) continue;
+                if (hit!.kind === "whole") {
+                    newValues[k] = await cipher.encrypt(JSON.stringify(v));
+                } else if (hit!.sub === null) {
+                    // whole json replacement → encrypt the configured paths inside
+                    newValues[k] = await encryptAt(cipher, v, hit!.paths!);
+                } else {
+                    // dot-notation leaf ('address.zip') → encrypt the value directly
+                    newValues[k] = await cipher.encrypt(JSON.stringify(v));
+                }
+            }
+            out[op] = newValues;
+        } else if (op === "$unset" || op === "$rename" || op === "$currentDate") {
+            // safe on encrypted fields — no value written
+        } else if (op.startsWith("$") && values && typeof values === "object") {
+            const targets = Object.keys(values).filter((k) => resolveKey(k) !== null);
+            if (targets.length) {
+                throw new AppError(
+                    `Operator ${op} on encrypted field(s) [${targets.join(", ")}] is not supported — only $set/$setOnInsert can write encrypted fields`,
+                    { code: "ENCRYPTED_FIELD_OPERATOR", status: 400 }
+                );
+            }
+        }
+    }
+    return out;
+}
+
+/** Decrypt the encrypted values in a read result (new object; non-ciphertext kept as-is) — manual use */
+export async function decryptFields(col: Collection | null, doc: any): Promise<any> {
+    const names = encryptedFields(col);
+    const pathFields = encryptedPaths(col);
+    if ((!names.length && !pathFields.length) || !doc || typeof doc !== "object" || !cfg.server.encryption?.mode) return doc;
+    const out: Record<string, any> = { ...doc };
+    const cipher = await getCipher();
+    for (const name of names) {
+        const v = out[name];
+        if (typeof v === "string") {
+            try {
+                out[name] = await cipher.decrypt(v, true);
+            } catch {
+                // not a ciphertext (legacy plaintext) → keep as-is
+            }
+        }
+    }
+    for (const { name, paths } of pathFields) {
+        const v = out[name];
+        if (v && typeof v === "object") out[name] = await decryptAt(cipher, v, paths);
+    }
+    return out;
+}
+
+async function decryptAt(cipher: any, value: any, paths: string[]): Promise<any> {
+    if (Array.isArray(value)) {
+        return Promise.all(value.map((item) => decryptAt(cipher, item, paths)));
+    }
+    if (!value || typeof value !== "object") return value;
+    const out: Record<string, any> = { ...value };
+    for (const p of paths) {
+        const v = getPath(out, p);
+        if (typeof v === "string") {
+            try {
+                setPath(out, p, await cipher.decrypt(v, true));
+            } catch {
+                // not a ciphertext → keep as-is
+            }
+        }
+    }
+    return out;
+}

package/database/mongodbadapter.ts

@@ -11,6 +11,7 @@ import { AppError, fn } from "../lib/error";
 import { createWorkflow } from "./workflow";
 import { getTenant } from "./tenant";
 import { getCollection, getCollectionKeys } from "./collection"
+import { encryptFields, encryptUpdate } from "./field.crypto"
 import type { RestActions, BulkUpdateOperation, RestOptions, CursorOptions, TenantCache } from "../types/rest";
 import type Joi from "joi";
 import type { Collection } from "../types/collection";
@@ -565,11 +566,15 @@ class MongoRest {
             // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
             meta.data = this._validate({ collection, action: action, data: meta.data })
 
-            await this.db.collection(collection).insertOne(func.toBson(meta.data, { col }) as any, {
+            // Field-level encryption: store ciphertext, keep plaintext for the response
+            const stored = await encryptFields(col, meta.data)
+            // ⚠️ toBson returns a copy — the driver's _id mutation never reaches meta.data,
+            // so the generated _id is taken from the InsertOneResult instead
+            const inserted = await this.db.collection(collection).insertOne(func.toBson(stored, { col }) as any, {
                 session: this.session,
             })
 
-            const result: T & { _id: string } = func.toJson(meta.data as T & { _id: string })
+            const result: T & { _id: string } = { ...func.toJson(meta.data as any), _id: (inserted.insertedId as ObjectId).toHexString() }
             meta.result = result
             if (col?.hooks?.afterOperation) {
                 await col.hooks.afterOperation({ rest: this, io, action, meta })
@@ -604,11 +609,17 @@ class MongoRest {
             // Validate AFTER hooks (they may fill required fields or apply Joi defaults)
             meta.data = this._validate({ collection, action: action, data: meta.data })
 
-            await this.db.collection(collection).insertMany(func.toBson(meta.data, { col }) as any, {
+            // Field-level encryption: store ciphertext, keep plaintext for the response
+            const stored = await encryptFields(col, meta.data)
+            const inserted = await this.db.collection(collection).insertMany(func.toBson(stored, { col }) as any, {
                 session: this.session,
             })
 
-            const result: (T & { _id: string })[] = func.toJson(meta.data as (T & { _id: string })[])
+            const json = func.toJson(meta.data) as any[]
+            const result: (T & { _id: string })[] = json.map((d, i) => ({
+                _id: (inserted.insertedIds[i] as ObjectId | undefined)?.toHexString() ?? d._id,
+                ...d,
+            }))
             meta.result = result
 
             if (col.hooks?.afterOperation) {
@@ -633,6 +644,8 @@ class MongoRest {
 
             update = await func.buildInput(update)
             this._validate({ collection, action: action, update: update })
+            // Field-level encryption: encrypt $set/$setOnInsert values for encrypted fields
+            update = await encryptUpdate(col, update)
             update = func.toBson(update, { col })
 
             const meta: any = { action, collection, update, id: _id }
@@ -697,6 +710,8 @@ class MongoRest {
 
             this._validate({ collection, action: action, update: update.$set })
             this._validate({ collection, action: action, update: update.$setOnInsert })
+            // Field-level encryption: encrypt $set/$setOnInsert values for encrypted fields
+            update = await encryptUpdate(col, update)
             update = func.toBson(update, { col })
             filter = func.toBson(filter, { col })
 
@@ -738,6 +753,8 @@ class MongoRest {
             }
             update = await func.buildInput(update)
             this._validate({ collection, action: action, update: update })
+            // Field-level encryption: encrypt $set/$setOnInsert values for encrypted fields
+            update = await encryptUpdate(col, update)
             update = func.toBson(update, { col })
 
             const meta: any = { action, collection, update, ids: _ids }
@@ -829,7 +846,7 @@ class MongoRest {
 
                 if ('insertOne' in operation) {
                     operation.insertOne.document = func.toBson(
-                        await func.buildInput(operation.insertOne.document, { action: 'insertOne', col }),
+                        await encryptFields(col, await func.buildInput(operation.insertOne.document, { action: 'insertOne', col })),
                         { col },
                     )
                 }
@@ -842,7 +859,7 @@ class MongoRest {
                     if (updateOneDoc.$set) {
                         updateOneDoc.$set = await func.buildInput(updateOneDoc.$set, { action: 'updateOne', col })
                     }
-                    operation.updateOne.update = func.toBson(operation.updateOne.update, { col })
+                    operation.updateOne.update = func.toBson(await encryptUpdate(col, operation.updateOne.update), { col })
                 }
                 if ('updateMany' in operation) {
                     operation.updateMany.filter = func.toBson(
@@ -853,11 +870,11 @@ class MongoRest {
                     if (updateManyDoc.$set) {
                         updateManyDoc.$set = await func.buildInput(updateManyDoc.$set, { action: 'updateMany', col })
                     }
-                    operation.updateMany.update = func.toBson(operation.updateMany.update, { col })
+                    operation.updateMany.update = func.toBson(await encryptUpdate(col, operation.updateMany.update), { col })
                 }
                 if ('replaceOne' in operation) {
                     operation.replaceOne.replacement = func.toBson(
-                        await func.buildInput(operation.replaceOne.replacement, { action: 'replaceOne', col }),
+                        await encryptFields(col, await func.buildInput(operation.replaceOne.replacement, { action: 'replaceOne', col })),
                         { col },
                     )
                 }
@@ -898,14 +915,14 @@ class MongoRest {
                     if (update.$set) {
                         update.$set = await func.buildInput(update.$set, { action: 'updateOne', col })
                     }
-                    operation.updateOne.update = func.toBson(operation.updateOne.update, { col })
+                    operation.updateOne.update = func.toBson(await encryptUpdate(col, operation.updateOne.update), { col })
                 }
                 if ('updateMany' in operation) {
                     const update = operation.updateMany.update as UpdateFilter<Document>
                     if (update.$set) {
                         update.$set = await func.buildInput(update.$set, { action: 'updateMany', col })
                     }
-                    operation.updateMany.update = func.toBson(operation.updateMany.update, { col })
+                    operation.updateMany.update = func.toBson(await encryptUpdate(col, operation.updateMany.update), { col })
                 }
             }
 

package/index.ts

@@ -6,7 +6,6 @@ import { useRest } from "./database/rest";
 import { AppError } from "./lib/error";
 import * as v from "joi";
 import utils from "./utils";
-import * as crypto from "./utils/crypto";
 
 
 
@@ -31,6 +30,5 @@ export {
     v,
     utils,
     cache,
-    crypto,
     logger,
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/boot.ts

@@ -38,7 +38,8 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         // Logging: configure from cfg.server.logging (console + file, e.g. logs/anteros.log)
         logger.configure(cfg.server.logging);
-        logger.info('Starting Anteros server', {
+        // File-only: the boxen banner already shows name / PID / URL / env on the console
+        logger.file('Starting Anteros server', {
             name: cfg.server.name ?? process.env.APP_NAME ?? 'SERVER',
             port: cfg.server.port ?? 4000,
             env: process.env.NODE_ENV || Bun.env.NODE_ENV || 'dev',

package/server/config.ts

@@ -21,6 +21,19 @@ function formatConfig(config: ServerConfig) { // format the config
     }
     cfg.version = config.version;
     cfg.tenants = config.tenants ?? [];
+
+    // Encryption mode validation — fail fast at boot: the declared mode
+    // must have its key configured (symmetric → secret, asymmetric → privateKey)
+    const enc = cfg.server.encryption;
+    if (enc) {
+        if (enc.mode === 'symmetric' && !enc.secret && !Bun.env.APP_SECRET) {
+            throw new Error(`server.encryption: mode 'symmetric' requires a secret — set encryption.secret or APP_SECRET env`);
+        }
+        if (enc.mode === 'asymmetric' && !enc.privateKey) {
+            throw new Error(`server.encryption: mode 'asymmetric' requires a privateKey — set encryption.privateKey (JWK or JSON string)`);
+        }
+    }
+
     return cfg;
 }